BlacklistIpExtractor.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#include "BlacklistIpExtractor.hpp"
#include <unordered_set>
#include <algorithm>
#include <filesystem>
#include <cstdio>
#include <unistd.h>
#include <regex>
 
namespace fs = std::filesystem;
 
static bool is_valid_ipv4(const std::string& s) {
    int parts = 0, acc = 0;
    bool has_digit = false;
 
    for (char c : s) {
        if (c >= '0' && c <= '9') {
            has_digit = true;
            acc = acc * 10 + (c - '0');
            if (acc > 255) return false;
        } else if (c == '.') {
            if (!has_digit) return false;
            parts++;
            acc = 0;
            has_digit = false;
        } else return false;
    }
 
    return has_digit && parts == 3;
}
 
static bool is_valid_ipv4_cidr(const std::string& s) {
    auto pos = s.find('/');
    if (pos == std::string::npos) return false;
    if (!is_valid_ipv4(s.substr(0, pos))) return false;
 
    try {
        int m = std::stoi(s.substr(pos + 1));
        return m >= 0 && m <= 32;
    } catch (...) {
        return false;
    }
}
 
static bool is_valid_ipv6(const std::string& s) {
    static const std::regex ipv6(
        R"(^([0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{0,4}$)"
    );
    return std::regex_match(s, ipv6);
}
 
static bool extract_host_from_url(const std::string& line, std::string& host) {
    static const std::regex url_re(
        R"(^(?:https?|ftp)://([^/:?#]+))",
        std::regex::icase
    );
 
    std::smatch m;
    if (!std::regex_search(line, m, url_re))
        return false;
 
    host = m[1].str();
    return true;
}
 
bool BlacklistIpExtractor::extractAndWrite(
    const std::vector<std::string>& lines,
    const std::string& outPath
) {
    std::unordered_set<std::string> unique;
 
    for (std::string line : lines) {
        // trim
        auto start = line.find_first_not_of(" \t\r\n");
        if (start == std::string::npos) continue;
        line.erase(0, start);
 
        if (auto pos = line.find('#'); pos != std::string::npos)
            line = line.substr(0, pos);
 
        auto end = line.find_last_not_of(" \t\r\n");
        if (end == std::string::npos) continue;
        line.erase(end + 1);
        if (is_valid_ipv4(line) ||
            is_valid_ipv4_cidr(line) ||
            is_valid_ipv6(line)) {
            unique.insert(line);
            continue;
        }
 
        std::string host;
        if (extract_host_from_url(line, host)) {
            if (is_valid_ipv4(host) || is_valid_ipv6(host)) {
                unique.insert(host);
            }
        }
    }
 
    if (unique.empty())
        return false;
 
    std::vector<std::string> ips(unique.begin(), unique.end());
    std::sort(ips.begin(), ips.end());
 
    std::string tmpl = outPath + ".XXXXXX";
    std::vector<char> path(tmpl.begin(), tmpl.end());
    path.push_back('\0');
 
    int fd = mkstemp(path.data());
    if (fd < 0) return false;
 
    FILE* f = fdopen(fd, "w");
    if (!f) { close(fd); return false; }
 
    for (const auto& ip : ips)
        fprintf(f, "%s\n", ip.c_str());
 
    fflush(f);
    fsync(fd);
    fclose(f);
 
    fs::rename(path.data(), outPath);
    fs::permissions(
        outPath,
        fs::perms::owner_read | fs::perms::owner_write,
        fs::perm_options::replace
    );
 
    return true;
}